{"id":"CVE-2026-89885","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: platform: mtk-mdp3: Fix SCP device refcounting\n\nmdp_probe() first tries to get the SCP handle with scp_get()","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: platform: mtk-mdp3: Fix SCP device refcounting\n\nmdp_probe() first tries to get the SCP handle with scp_get(). When that\nfails, it falls back to looking up the SC…","severity":"high","cvss":8.4,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","vendor":"Linux","product":"Linux","affected":["Linux >= db4d27e6bbbf511f9cdb33f682535a0a3cb7c403 < dce13bd9bade3ecc1acb7579397f24743850997f","Linux >= 31ba1a4d7a5d9466f6ef4910a372b8200f8aad19 < 252850653569fdb1a259937e02325cf32c8f0970","Linux >= 8f6f3aa21517ef34d50808af0c572e69580dca20 < 0259ade4c4ceaf1e184a7c1aea8071ad398f9b6f","Linux >= 8f6f3aa21517ef34d50808af0c572e69580dca20 < 55793e4665b7f15151e6f5ab51ca980e73abed5d","Linux >= 6.12.64 < 6.12.110","Linux >= 6.18.4 < 6.18.51","Linux 6.19"],"published":"2026-09-16","updated":"2026-09-16","sourceUpdated":"2026-09-16T15:18:15.090","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-89885","references":[{"url":"https://git.kernel.org/stable/c/0259ade4c4ceaf1e184a7c1aea8071ad398f9b6f","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/252850653569fdb1a259937e02325cf32c8f0970","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/55793e4665b7f15151e6f5ab51ca980e73abed5d","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dce13bd9bade3ecc1acb7579397f24743850997f","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"tags":["nvd","cve.org"],"ingestedAt":"2026-09-16T10:53:53.983Z","epss":0.0018,"epssPercentile":0.07842,"slug":"CVE-2026-89885","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmedia: platform: mtk-mdp3: Fix SCP device refcounting\n\nmdp_probe() first tries to get the SCP handle with scp_get(). When that\nfails, it falls back to looking up the SCP platform device with\n__get_pdev_by_id() and then reads its driver data.\n\nThe fallback lookup returns the platform device with a reference, just\nlike scp_get() does. However, the fallback path currently drops that\nreference immediately after platform_get_drvdata(). The driver later\nstill calls scp_put(mdp->scp) unconditionally from the probe error path\nand from mdp_video_device_release(), which drops the SCP device\nreference again.\n\nKeep the fallback reference until the existing scp_put() call, so that\nthe fallback path follows the same ownership rules as the scp_get()\npath.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":46,"depthScoreParts":{"impact":46.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":205166,"id":"CVE-2026-89885","ts":1789570705550,"field":"cvss","old":null,"new":"8.4"},{"seq":205165,"id":"CVE-2026-89885","ts":1789570705550,"field":"severity","old":"none","new":"high"}]}